Technology & Innovation

How WEDOS Protection works
in real-world attacks

WEDOS Protection is designed by infrastructure operators, not based on theoretical security models. All protection layers work together automatically — malicious traffic is filtered at the edge, long before it reaches your infrastructure.

See Pricing Contact Us

Origin

Built by a Datacenter,
for Datacenters

WEDOS took the opposite approach. As an operator of one of Europe's largest hosting and DNS platforms, we built our protection to defend our own infrastructure under real-world attack conditions.

Every architectural decision reflects that experience. WEDOS Protection is designed not from theory, but from operational reality at scale.

Built for real-world attacks. Not designed in theory.

Network Architecture

Global Anycast Architecture

The foundation of WEDOS Protection is a purpose-built global anycast network. It is not leased from a hyperscaler and not assembled from multiple providers. Every point of presence is fully owned, operated, and maintained by WEDOS.

How it works:

Using BGP Anycast, incoming traffic is automatically routed to the nearest WEDOS PoP. Attack traffic is distributed across more than 120 locations at the same time, regardless of where it comes from or how large it is.

No single node takes the full impact.

There is no single point of failure.

Why it matters at scale:

Volumetric attacks in the terabit range cannot be stopped by sending traffic to a single scrubbing center and hoping capacity is enough. They are stopped by having more distributed capacity than the attacker can concentrate.

WEDOS Anycast provides that capacity, with one of the densest PoP networks in Europe and a top-tier global footprint. Traffic scrubbing happens at the edge. Clean traffic reaches your origin. The attack never does.

Protection Engine

Multi-Layer Protection Engine

— WEDOS Protection operates across the full OSI stack, simultaneously and automatically, without requiring manual mode switching between attack types.

L3/L4 Network & Transport

Stops high-volume and protocol-based attacks within seconds.

Key capabilities:

Stateful packet inspection & rate-based filtering
Instant mitigation of volumetric attacks
Built to absorb multi-Tbps traffic
No service degradation under load

Blocked attack types:

SYN floods
UDP floods
ICMP floods
DNS, NTP & SNMP amplification

L7 Application Layer

Detects and blocks sophisticated attacks that mimic real users.

Key capabilities:

AI-driven behavioural analysis
Real-time anomaly scoring
OWASP ruleset enforcement
Fully configurable rule engine

Blocked attack types:

SQL injection
Cross-site scripting (XSS)
Slowloris & RUDY
HTTP floods & Credential stuffing

Visibility

Observability & Threat Intelligence

“Security without visibility is not security.”

Real-time Grafana dashboards

Traffic volume, attack classification, filtering decisions, and origin analytics — all accessible to operators and partners in real time.

Audit-grade event logging

Every security event logged with full forensic context, retained within EU jurisdiction.

SIEM integration

Structured log export compatible with standard SIEM platforms for centralised security operations.

Threat intelligence sharing

Attack patterns observed across the WEDOS platform inform detection rules globally, creating a network effect that improves with scale.

Privacy & Data Security

Encryption Architecture

In WEDOS Protection, decryption occurs exclusively on dedicated hardware within certified EU data centres, isolated from shared workloads. Traffic is re-encrypted before forwarding to the origin server. No decrypted content is stored. No third party has access to the decryption process or its outputs.

Sovereignty

Infrastructure Ownership: Why It Matters

No upstream SLA to hide behind

When something needs fixing, we fix it — directly, without escalating to a third-party vendor chain.

No third-party access to your traffic or logs

Data remains inside our infrastructure, never passing through external parties.

No foreign legal instrument with jurisdiction over your data

Fully under EU legal framework — GDPR compliant by design.

Full platform accountability

When a new attack vector emerges, we respond across the entire platform — not after a vendor ticket is resolved upstream.

Try WEDOS Protection

Advanced Features

Comprehensive protection
in a single solution

Next-Generation Client Identification

JA4 Fingerprinting

A modern method for identifying clients based on their behavior in TLS communication. Unlike JA3, it produces a structured and human-readable fingerprint — TLS version, cipher suites, extensions. Even attackers rotating IPs produce the same fingerprint.

Attack patterns detected for one customer help protect all others.

Precision at Every Level

Intelligent Rule Engine

Rules configurable at the domain, page, and API level. Combine IP address, geolocation, visitor behavior, JA4 fingerprint, or request rate.

Protection levels adjustable instantly — from normal operation to aggressive attack mode. Changes apply across the entire network in real time.

Built on Real DNS Infrastructure

DNS Protection & DNSSEC

Safeguards DNS against overload (DNS floods), limits excessive traffic, and prevents abuse in amplification attacks. Full DNSSEC support ensures DNS responses are authentic and have not been altered in transit.

DNS protection at WEDOS is not an add-on — built on our own large-scale DNS infrastructure, continuously tested under real-world attack conditions.

Start protecting your services